What is User Information list in SharePoint Online and what is its use?

Question

What is User Information list in SharePoint Online and what is its use?

Ajit Kumar 0

What is User Information list in SharePoint Online and what is its use?

Is there any difference between Public & Private SharePoint site's User Information list?

Ajit Kumar 0 Reputation points

2026-09-03T11:39:18.9033333+00:00

When we create a Private Teams SharePoint site, its user information list has everyone and everyone except external user group. Although both groups do not have any permission on the site or its content. I tested it with the new Private Teams SharePoint site in multiple tenants and getting the same behavior. Explain this behavior, why this happens?

2 answers

Your answer

Ajit Kumar 0 Reputation points

2026-09-03T11:39:18.9033333+00:00

When we create a Private Teams SharePoint site, its user information list has everyone and everyone except external user group. Although both groups do not have any permission on the site or its content. I tested it with the new Private Teams SharePoint site in multiple tenants and getting the same behavior. Explain this behavior, why this happens?

Answer 1

Killian N 3,820 Independent Advisor

Hi Ajit,

The User Information List is a hidden, system-managed SharePoint list that stores information about users, groups, and identity claims that have been resolved or referenced within the site. SharePoint uses it for permissions, People fields, sharing, and values such as Created By and Modified By.

There is no separate type of User Information List for public and private sites. The main difference is the permissions assigned during site provisioning.

In a private Teams-connected site, Everyone and Everyone except external users may appear in the User Information List because SharePoint resolved these built-in claims during provisioning or an internal operation. Their presence in this list does not grant them access to the site.

If these principals do not appear in the site permissions, SharePoint groups, sharing links, or unique permissions, they cannot access the site or its content. Therefore, the behavior you observed is expected and does not indicate that the private site is accessible to everyone.

For more information, please refer to the following link:

I hope this clarifies the behavior. Please feel free to share if you would like further assistance.

Kind regards,

If the answer is helpful, please click "Yes". If you have extra questions about this answer, please click "Comment".

Ajit Kumar 0 Reputation points

2026-09-03T16:02:04.86+00:00

Is this not a BUG with the Private SharePoint Team sites?

Because if Everyone and Everyone except external users groups do not have permission on site or site content then it should NOT appears in its user info list.

Its not mentioned anywhere in both article which says that both groups should appears in Private SharePoint Team sites user info list without permission. Both articles discuss about both groups & its behavior with Public SharePoint Team sites.

https://learn.microsoft.com/en-us/sharepoint/data-access-governance-everyone-except-external-user-report

https://learn.microsoft.com/en-us/troubleshoot/sharepoint/sharing-and-permissions/everyone-except-external-user-removed

I would like to request MS to discuss in detail about Everyone and Everyone except external users groups with private site behavior.
Killian N 3,820 Reputation points Independent Advisor

2026-09-04T17:41:31.75+00:00

Hi Ajit,

Thank you for the additional clarification. I can certainly understand why this behavior raises questions, particularly since the Microsoft documentation you shared does not clearly explain why the Everyone and Everyone except external users principals can appear in the User Information List of a private Teams-connected SharePoint site, even when they do not have access to the site itself.

From what I understand, the mere presence of these principals in the User Information List does not mean they have been granted permissions. Rather, the User Information List is a system-maintained component used by SharePoint to store and reference user and group information, and it should not be interpreted as an indication of effective access rights.

That said, I completely understand your concern. Since you have observed the same behavior across multiple tenants, it is reasonable to question whether this is expected by design or whether there may be an underlying issue that is not currently documented.

I believe the best next step would be to raise the matter with Microsoft Support. They would be in the best position to verify whether this is standard provisioning behavior for Teams-connected SharePoint sites or whether it represents a product issue that requires further investigation.

I also appreciate you highlighting the documentation gap. Clearer guidance from Microsoft on how these built-in principals are handled within the User Information List of private sites would certainly help avoid confusion and provide administrators with greater transparency.

Kind regards,

Answer 2

The User Information List in SharePoint Online is a hidden SharePoint list that stores site-level information about people who have visited or been added to a site. SharePoint saves user details such as full name and email address, and it uses this information in site content and permissions-related experiences.

Its use includes:

Keeping a record of users known to that site
Supporting person-related metadata in SharePoint content
Populating fields such as Created By and Modified By on site elements
Supporting user lookups and user-related behaviors at the site level

This is why deleted or replaced accounts can still appear in SharePoint experiences: the site can retain an entry in the hidden User Information List even after the account is deleted elsewhere.

For example, Microsoft documents that when a user account is deleted and recreated with the same UPN, access problems can occur because the SharePoint or OneDrive site still has the old ID in the UserInfo list. Microsoft also notes that deleting an account in Azure AD does not automatically remove that entry from the site’s hidden User Information List.

On public vs. private SharePoint sites: the available context does not describe a different User Information List design or behavior between public and private SharePoint sites. The supported information only shows that the list is associated with a SharePoint site and stores user information for that site.

References: